Database Anomalous Activities - Detection and Quantification
Elisa Costante, Sokratis Vavilis, Sandro Etalle, Jerry den Hartog, Milan Petković, Nicola Zannone · 2013
The disclosure of sensitive data to unauthorized entities is a critical issue for organizations. Timely detection of data leakage is crucial to reduce possible damages. Therefore, breaches should be detected as early as possible, e.g., when data are leaving the database. In this paper, we focus on data leakage detection by monitoring database activities. We present a framework that automatically learns \\emph{normal} user behavior, in terms of database activities, and detects anomalies as deviation from such behavior. In addition, our approach explicitly indicates the root cause of an anomaly. Finally, the framework assesses the severity of data leakages based on the sensitivity of the disclosed data. Keywords: Data Misuse, Data Leakage, Database Activity Monitoring, Data Leakage Quanti¿cation.